xgtcyy.exe

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	xgtcyy.exe
size	19456 (0x4c00)
md5	0cf71d7fde7717175a32f8799065f6e2

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe8

Rich Header

lib id	version	times used
19	8078	4
14	7299	2
10	8047	11
4	8047	2
93	4035	9
1	0	104
11	8168	5

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x547734bc
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0x3400
SizeOfInitializedData	0x2800
SizeOfUninitializedData	0
AddressOfEntryPoint	0x40e2
BaseOfCode	0x1000
BaseOfData	0x5000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x8000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x3274	0x3400	R-X CODE
.rdata	0x5000	0x96c	0xa00	R-- IDATA
.data	0x6000	0x1c8c	0xa00	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x51d4	0x8c
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x5000	0x1b4
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	ord	function_name
KERNEL32.dll	114		CreateToolhelp32Snapshot
KERNEL32.dll	722		ResumeThread
KERNEL32.dll	102		CreateProcessA
KERNEL32.dll	836		SetThreadPriority
KERNEL32.dll	325		GetCurrentThread
KERNEL32.dll	817		SetPriorityClass
KERNEL32.dll	322		GetCurrentProcess
KERNEL32.dll	966		lstrcpyA
KERNEL32.dll	437		GetShortPathNameA
KERNEL32.dll	381		GetModuleFileNameA
KERNEL32.dll	662		Process32First
KERNEL32.dll	369		GetLastError
KERNEL32.dll	96		CreateMutexA
KERNEL32.dll	972		lstrlenA
KERNEL32.dll	67		CopyFileA
KERNEL32.dll	383		GetModuleHandleA
KERNEL32.dll	453		GetSystemInfo
KERNEL32.dll	448		GetSystemDefaultUILanguage
KERNEL32.dll	439		GetStartupInfoA
KERNEL32.dll	963		lstrcmpiA
KERNEL32.dll	664		Process32Next
KERNEL32.dll	912		WaitForSingleObject
KERNEL32.dll	52		CloseHandle
KERNEL32.dll	469		GetTempPathA
KERNEL32.dll	957		lstrcatA
KERNEL32.dll	594		LoadLibraryA
KERNEL32.dll	416		GetProcAddress
KERNEL32.dll	917		WinExec
KERNEL32.dll	111		CreateThread
KERNEL32.dll	186		ExitThread
KERNEL32.dll	854		Sleep
KERNEL32.dll	185		ExitProcess
KERNEL32.dll	479		GetTickCount
USER32.dll	727		wsprintfA
ADVAPI32.dll	503		RegQueryValueExA
ADVAPI32.dll	100		CreateServiceA
ADVAPI32.dll	431		OpenServiceA
ADVAPI32.dll	585		StartServiceA
ADVAPI32.dll	491		RegOpenKeyA
ADVAPI32.dll	516		RegSetValueExA
ADVAPI32.dll	62		CloseServiceHandle
ADVAPI32.dll	459		RegCloseKey
ADVAPI32.dll	492		RegOpenKeyExA
ADVAPI32.dll	586		StartServiceCtrlDispatcherA
ADVAPI32.dll	524		RegisterServiceCtrlHandlerA
ADVAPI32.dll	580		SetServiceStatus
ADVAPI32.dll	429		OpenSCManagerA
WS2_32.dll		18
WS2_32.dll		151
WS2_32.dll	40		WSAIoctl
WS2_32.dll		8
WS2_32.dll		19
WS2_32.dll		16
WS2_32.dll		116
WS2_32.dll		115
WS2_32.dll		12
WS2_32.dll		57
WS2_32.dll	65		WSASocketA
WS2_32.dll		21
WS2_32.dll		11
WS2_32.dll		52
WS2_32.dll		23
WS2_32.dll		9
WS2_32.dll		4
WS2_32.dll		3
WS2_32.dll		20
MSVCRT.dll	702		strlen
MSVCRT.dll	183		_controlfp
MSVCRT.dll	129		__set_app_type
MSVCRT.dll	111		__p__fmode
MSVCRT.dll	585		exit
MSVCRT.dll	106		__p__commode
MSVCRT.dll	157		_adjust_fdiv
MSVCRT.dll	131		__setusermatherr
MSVCRT.dll	271		_initterm
MSVCRT.dll	88		__getmainargs
MSVCRT.dll	143		_acmdln
MSVCRT.dll	72		_XcptFilter
MSVCRT.dll	211		_exit
MSVCRT.dll	657		malloc
MSVCRT.dll	606		free
MSVCRT.dll	696		strcmp
MSVCRT.dll	16		void __cdecl operator delete(void *) ??3@YAXPAX@Z
MSVCRT.dll	202		_except_handler3
MSVCRT.dll	709		strstr
MSVCRT.dll	694		strcat
MSVCRT.dll	573		atoi
MSVCRT.dll	663		memcpy
MSVCRT.dll	678		rand
MSVCRT.dll	690		sprintf
MSVCRT.dll	695		strchr
MSVCRT.dll	698		strcpy
MSVCRT.dll	692		srand
MSVCRT.dll	665		memset
MSVCRT.dll	653		localtime
MSVCRT.dll	705		strncpy
MSVCRT.dll	699		strcspn
MSVCRT.dll	720		time
MSVCRT.dll	670		printf
MSVCRT.dll	15		void * __cdecl operator new(unsigned int) ??2@YAPAXI@Z
MSVCRT.dll	704		strncmp
iphlpapi.dll	20		GetAdaptersInfo
iphlpapi.dll	30		GetIfTable

show previews

offset	size	type	comment
0	19456	EXE	11/27/2014 14:27:08	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK